@datumos/datum-cli 0.0.0 → 0.588.0

package/cli/artifactsPublish.js

@@ -0,0 +1,356 @@
+/**
+ * `datum artifacts publish <dir>` — publishing an artifact from OUTSIDE a
+ * run (#589, docs/artifacts.md "Publishing from outside a run").
+ *
+ * Hand-written, unlike every other API command in this CLI, because it is
+ * not one API call: it walks a directory, decides a TRANSPORT and then
+ * drives either the one-call shortcut (POST /api/artifacts/publish, small
+ * pages travel in the body) or the two-step direct upload (plan → a
+ * presigned PUT per file → commit), which is what the runtime does at the
+ * end of a run. A flag-based derived command could express neither the
+ * walk nor the PUTs, so `POST /api/artifacts/publish` is `x-cli: hidden`
+ * in the spec and this command owns the name.
+ *
+ * What it never does: choose a visibility. A published artifact starts
+ * space-private and a human climbs the ladder in the panel (security
+ * invariant I1); a new version of an artifact ALREADY shared beyond its
+ * space comes back as a `draft` and this command says where it waits.
+ */
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import fsp from "node:fs/promises";
+import path from "node:path";
+import { apiSurface, UsageError } from "./invoke.js";
+/**
+ * The server's caps, mirrored here so the CLI can decide the transport
+ * before it talks to anyone. The server is the source of truth
+ * (`server/src/outputs/outputs.interfaces.ts`,
+ * `MAX_INLINE_PUBLICATION_BYTES` / `MAX_OUTPUTS_PER_RUN`); the CLI cannot
+ * import from there — the published npm package ships `cli/` and the spec
+ * alone — so `artifactsPublish.test.ts` pins these to the server's values.
+ */
+export const MAX_INLINE_PUBLICATION_BYTES = 8 * 1024 * 1024;
+export const MAX_PUBLICATION_FILES = 200;
+/** Deepest directory nesting the collector walks (the server's MAX_DEPTH). */
+export const MAX_PUBLICATION_DEPTH = 6;
+/** The manifest rides the request body, never as a file of the publication. */
+export const PUBLICATION_MANIFEST_NAME = "manifest.json";
+/** The server's `ARTIFACT_KEY_RE` (outputs.interfaces.ts), mirrored like the caps. */
+export const PUBLICATION_KEY_RE = /^[A-Za-z0-9._:/-]{1,120}$/;
+const line = (s, text) => s.write(`${text}\n`);
+/**
+ * The publication's files, by the SAME rules the collector applies to a
+ * run's outputs/ directory: no dotfiles, no `node_modules`, no symlinks,
+ * no empty files, at most 6 levels deep, at most 200 files. The manifest
+ * is not a file of the publication — it rides the request body.
+ */
+export async function walkPublication(dir, depth = 0, root = dir) {
+    if (depth > MAX_PUBLICATION_DEPTH)
+        return [];
+    let entries;
+    try {
+        entries = await fsp.readdir(dir, { withFileTypes: true });
+    }
+    catch (err) {
+        const code = err.code;
+        if (depth === 0 && (code === "ENOENT" || code === "ENOTDIR")) {
+            throw new UsageError(`${dir} is not a directory`);
+        }
+        throw err;
+    }
+    entries.sort((a, b) => a.name.localeCompare(b.name));
+    const out = [];
+    for (const entry of entries) {
+        if (entry.name.startsWith("."))
+            continue;
+        if (entry.name === "node_modules")
+            continue;
+        const abs = path.join(dir, entry.name);
+        if (entry.isSymbolicLink())
+            continue;
+        if (entry.isDirectory()) {
+            out.push(...(await walkPublication(abs, depth + 1, root)));
+            continue;
+        }
+        if (!entry.isFile())
+            continue;
+        const rel = path.relative(root, abs).split(path.sep).join("/");
+        if (rel === PUBLICATION_MANIFEST_NAME)
+            continue;
+        const stat = await fsp.stat(abs);
+        if (stat.size === 0)
+            continue;
+        out.push({ rel, abs, size: stat.size, sha256: await hashFile(abs) });
+    }
+    return out;
+}
+async function hashFile(abs) {
+    const hash = createHash("sha256");
+    for await (const chunk of fs.createReadStream(abs)) {
+        hash.update(chunk);
+    }
+    return hash.digest("hex");
+}
+/** `<dir>/manifest.json`, when it is there and parses; else nothing. */
+export async function readPublicationManifest(dir) {
+    let text;
+    try {
+        text = await fsp.readFile(path.join(dir, PUBLICATION_MANIFEST_NAME), "utf8");
+    }
+    catch {
+        return {};
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new UsageError(`${path.join(dir, PUBLICATION_MANIFEST_NAME)} is not valid JSON — fix it or pass --key/--title instead`);
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new UsageError(`${path.join(dir, PUBLICATION_MANIFEST_NAME)} must be a JSON object { key, title, description, entry }`);
+    }
+    const doc = parsed;
+    const pick = (name) => typeof doc[name] === "string" && doc[name] !== "" ? { [name]: doc[name] } : {};
+    return {
+        ...pick("key"),
+        ...pick("title"),
+        ...pick("description"),
+        ...pick("entry"),
+        ...pick("kind"),
+        // #2883: dropping the rules would publish the page under the defaults.
+        ...(doc.state !== undefined ? { state: doc.state } : {}),
+    };
+}
+/** The manifest as the request will carry it — the flags win over the file. */
+export function mergeManifest(manifest, flags) {
+    const merged = { ...manifest };
+    for (const name of ["key", "title", "description", "entry"]) {
+        const value = flags[name];
+        if (value !== undefined)
+            merged[name] = value;
+    }
+    return merged;
+}
+/**
+ * Which door: the whole set in one request body while it fits the inline
+ * cap, the two-step direct upload above it. The plan/commit path exists
+ * because the platform's public edge cuts bodies of a few MB (#556) — an
+ * artifact may carry hundreds of megabytes of assets.
+ *
+ * The cap is measured on what actually travels: the SERIALIZED body, JSON
+ * envelope and base64 padding included. Binary assets grow a third on the
+ * way in, so a set of raw bytes under the cap can still be a request over
+ * it — deciding on the raw sum would send it inline and earn a 413.
+ */
+export function transportFor(bodyBytes) {
+    return bodyBytes <= MAX_INLINE_PUBLICATION_BYTES ? "inline" : "direct";
+}
+/** What the inline body weighs on the wire. */
+export function serializedBodyBytes(body) {
+    return Buffer.byteLength(JSON.stringify(body));
+}
+/**
+ * The cheap half of the decision: the raw bytes are a LOWER bound on the
+ * serialized body (JSON and base64 only ever add), so a set already over
+ * the cap goes direct without being read into memory at all.
+ */
+export function exceedsInlineCapUnencoded(files) {
+    return files.reduce((n, f) => n + f.size, 0) > MAX_INLINE_PUBLICATION_BYTES;
+}
+/** The inline body: text files as UTF-8, everything else base64. */
+export async function inlinePublicationBody(fields, files) {
+    const out = [];
+    for (const file of files) {
+        const bytes = await fsp.readFile(file.abs);
+        // Bytes that survive a UTF-8 round trip travel as text — a page reads
+        // as itself in the request and the body stays a third smaller.
+        const text = bytes.toString("utf8");
+        out.push(Buffer.from(text, "utf8").equals(bytes)
+            ? { path: file.rel, content: text }
+            : { path: file.rel, contentBase64: bytes.toString("base64") });
+    }
+    return { ...fields, files: out };
+}
+/** The declaration both plan and commit send. */
+export function declarationOf(files) {
+    return files.map((f) => ({ path: f.rel, size: f.size, sha256: f.sha256 }));
+}
+/**
+ * The command. Exit 0 on a recorded version, 1 on a refusal (the server's
+ * `error` is printed as it came), 2 on a usage problem.
+ */
+export async function runArtifactsPublish(args, config, io) {
+    const doFetch = io.fetchImpl ?? fetch;
+    let surface;
+    let files;
+    let fields;
+    try {
+        surface = apiSurface(config);
+        files = await walkPublication(args.dir);
+        if (files.length === 0) {
+            throw new UsageError(`${args.dir} holds nothing to publish — a page (.html or .md) plus the assets it references ` +
+                `(dotfiles, node_modules, symlinks and empty files are never collected)`);
+        }
+        if (files.length > MAX_PUBLICATION_FILES) {
+            throw new UsageError(`${args.dir} holds ${files.length} files — a publication takes at most ${MAX_PUBLICATION_FILES}`);
+        }
+        fields = mergeManifest(await readPublicationManifest(args.dir), {
+            ...(args.key !== undefined ? { key: args.key } : {}),
+            ...(args.title !== undefined ? { title: args.title } : {}),
+            ...(args.description !== undefined ? { description: args.description } : {}),
+            ...(args.entry !== undefined ? { entry: args.entry } : {}),
+        });
+        if (!fields.key) {
+            throw new UsageError("a publication needs --key (or a `key` in manifest.json) — it is the artifact's stable " +
+                "identity in the space: the same key appends a version to the SAME link");
+        }
+        // The server's grammar, checked here too: a bad key must not cost a
+        // walk, hashes and an upload before the refusal (e2e 2026-09-07).
+        if (!PUBLICATION_KEY_RE.test(fields.key)) {
+            throw new UsageError(`key "${fields.key}" is not valid — 1–120 characters of letters, digits and \`. _ : / -\``);
+        }
+    }
+    catch (err) {
+        if (err instanceof UsageError) {
+            line(io.err, `datum: ${err.message}`);
+            return 2;
+        }
+        throw err;
+    }
+    try {
+        // Build the inline body once — it is both the transport decision and,
+        // when it fits, the request itself. A set whose raw bytes already
+        // exceed the cap never gets built.
+        const inlineBody = exceedsInlineCapUnencoded(files)
+            ? null
+            : await inlinePublicationBody(fields, files);
+        const inlineBytes = inlineBody === null ? null : serializedBodyBytes(inlineBody);
+        const publication = inlineBody !== null && inlineBytes !== null && transportFor(inlineBytes) === "inline"
+            ? await publishInline(inlineBody, surface, doFetch)
+            : await publishDirect(fields, files, surface, doFetch, io, inlineBytes);
+        report(publication, io);
+        // A publication is one set, so a file the server did not take makes the
+        // whole command a refusal (#589 review, round 2): the server refuses an
+        // incomplete publication with a 409 now, but a client must not read a
+        // 200 with `rejected` as success — `datum artifacts publish` in a
+        // pipeline has to fail where the page would render broken.
+        return (publication.rejected?.length ?? 0) > 0 ? 1 : 0;
+    }
+    catch (err) {
+        if (err instanceof PublishRefused) {
+            line(io.err, `datum: ${err.message}`);
+            return 1;
+        }
+        if (err instanceof UsageError) {
+            line(io.err, `datum: ${err.message}`);
+            return 2;
+        }
+        throw err;
+    }
+}
+/** A refusal from the server (or from the upload), already human-readable. */
+class PublishRefused extends Error {
+}
+async function publishInline(body, surface, doFetch) {
+    return callJson(doFetch, surface.url("/api/artifacts/publish"), surface.headers, body);
+}
+async function publishDirect(fields, files, surface, doFetch, io, 
+/** What one inline request would have weighed; null = never measured. */
+inlineBytes) {
+    const plan = await callJson(doFetch, surface.url("/api/artifacts/publish/plan"), surface.headers, { files: declarationOf(files), ...(fields.key ? { key: fields.key } : {}) });
+    if (plan.mode === "tar") {
+        // No reachable presigned URLs here (a dev MinIO, or an instance without
+        // a public bucket endpoint), and the set is over the inline cap — there
+        // is no third transport for a person: say so instead of half-uploading.
+        // The weight is the request body's when we got to measure it: a set of
+        // raw bytes under the cap is over it once base64-encoded.
+        const weight = inlineBytes === null
+            ? humanBytes(files.reduce((n, f) => n + f.size, 0))
+            : `${humanBytes(inlineBytes)} of request body (${humanBytes(files.reduce((n, f) => n + f.size, 0))} of files, encoded)`;
+        throw new PublishRefused(`this instance cannot hand out upload URLs (the plan answered mode "tar"), and ` +
+            `${weight} does not fit the inline cap of ` +
+            `${humanBytes(MAX_INLINE_PUBLICATION_BYTES)} — publish a smaller set, or run the publication ` +
+            `where the platform's file storage is reachable`);
+    }
+    const byPath = new Map(plan.files.map((f) => [f.path, f]));
+    const rejected = plan.files.filter((f) => f.action === "reject");
+    if (rejected.length > 0) {
+        throw new PublishRefused(`the server refused ${rejected.length} file(s): ` +
+            rejected.map((f) => `${f.path} (${f.reason ?? "no reason given"})`).join("; "));
+    }
+    const send = files.filter((f) => byPath.get(f.rel)?.action === "upload");
+    for (const file of send) {
+        const entry = byPath.get(file.rel);
+        if (!entry.url) {
+            throw new PublishRefused(`the plan gave no upload URL for ${file.rel}`);
+        }
+        const res = await doFetch(entry.url, {
+            method: "PUT",
+            headers: entry.headers ?? {},
+            body: await fsp.readFile(file.abs),
+        });
+        if (!res.ok) {
+            throw new PublishRefused(`uploading ${file.rel} failed with HTTP ${res.status} — the upload URL is short-lived, try again`);
+        }
+    }
+    if (send.length > 0) {
+        line(io.err, `Uploaded ${send.length} of ${files.length} file(s); the rest were already stored.`);
+    }
+    // Commit everything the plan did not skip: the files just uploaded plus
+    // the ones this space's bucket already held.
+    const commit = files.filter((f) => byPath.get(f.rel)?.action !== "skip");
+    return callJson(doFetch, surface.url("/api/artifacts/publish/commit"), surface.headers, { ...fields, files: declarationOf(commit) });
+}
+async function callJson(doFetch, url, headers, body) {
+    const res = await doFetch(url, {
+        method: "POST",
+        headers: { ...headers, "content-type": "application/json", accept: "application/json" },
+        body: JSON.stringify(body),
+        redirect: "manual",
+    });
+    const text = await res.text();
+    let parsed = {};
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        // not JSON — the message below carries the status and a snippet
+    }
+    if (!res.ok) {
+        const detail = typeof parsed.error === "string" ? parsed.error : text.slice(0, 200).trim();
+        const code = typeof parsed.code === "string" ? ` [${parsed.code}]` : "";
+        throw new PublishRefused(`HTTP ${res.status}${code} — ${detail || "no detail"} (${url})`);
+    }
+    return parsed;
+}
+/** What the person sees: the artifact, the version, where to read it. */
+function report(publication, io) {
+    const artifact = publication.artifact ?? {};
+    line(io.out, artifact.title ?? artifact.key ?? "(untitled artifact)");
+    if (publication.version !== null && publication.version !== undefined) {
+        line(io.out, `v${publication.version} ${publication.state ?? ""}`.trim());
+    }
+    else {
+        // The whole declared set was already recorded for this key (#590): a
+        // re-publication of an unchanged directory takes no version. Say it,
+        // rather than printing an address and letting the person assume a new
+        // version is live.
+        line(io.out, "no new version — every file was already published under this key");
+    }
+    if (publication.url)
+        line(io.out, publication.url);
+    if (publication.state === "draft") {
+        line(io.out, `awaits approval in the panel: ${publication.panelUrl || "(no panel link configured)"}`);
+    }
+    for (const skipped of publication.skipped ?? []) {
+        line(io.err, `unchanged: ${skipped}`);
+    }
+    for (const r of publication.rejected ?? []) {
+        line(io.err, `rejected: ${r.path} — ${r.reason}`);
+    }
+}
+function humanBytes(n) {
+    return n >= 1024 * 1024 ? `${(n / (1024 * 1024)).toFixed(1)} MiB` : `${n} bytes`;
+}
+//# sourceMappingURL=artifactsPublish.js.map

package/cli/authCommands.js

@@ -0,0 +1,168 @@
+import { originOf } from "./credentials.js";
+import { LoginFlowError, NotLoggedInError, decodeJwtPayload, deviceLogin, ensureAccessToken, spaceBaseUrl, } from "./entraLogin.js";
+import { UsageError } from "./invoke.js";
+import { insecureOriginReason } from "./secureOrigin.js";
+/** One sentence for the person when a key shadows the sign-in they just
+ * made or asked about. */
+export function apiKeyShadowNote(source) {
+    return (`Note: an API key is set (${source}) and a key always wins over the sign-in — ` +
+        `API commands will run AS THAT KEY on /public/api, not as you. ` +
+        `Unset it (or drop --api-key) to act as yourself.`);
+}
+/** The base URL an env var pins, when it names a DIFFERENT origin than the
+ * login just made: env wins over the stored default on every call, so the
+ * person would hit the other deployment unsigned — say so at login time. */
+export function shadowingBaseUrl(env, origin) {
+    for (const name of ["DATUM_BASE_URL", "MCA_BASE_URL"]) {
+        const value = env[name]?.trim();
+        if (!value)
+            continue;
+        let other;
+        try {
+            other = originOf(value);
+        }
+        catch {
+            return { name, value };
+        }
+        if (other !== origin)
+            return { name, value: other };
+        return null; // the env agrees with the login — nothing to say
+    }
+    return null;
+}
+const line = (s, text) => s.write(`${text}\n`);
+export async function runLogin(baseUrl, io) {
+    const origin = originOf(baseUrl);
+    try {
+        const login = await deviceLogin(origin, io.store, (device) => {
+            line(io.err, `Sign in to ${origin}:`);
+            line(io.err, `  open  ${device.verificationUriComplete ?? device.verificationUri}`);
+            line(io.err, `  code  ${device.userCode}`);
+            line(io.err, `Waiting for the sign-in to complete (the code is valid for ${Math.round((device.expiresAt - (io.now ?? Date.now)()) / 60000)} min)…`);
+        }, io);
+        line(io.err, `Signed in to ${origin} as ${login.account || "(unknown account)"}.`);
+        line(io.err, `Credentials: ${io.store.path} (mode 0600). This is now the default --base-url.`);
+        if (io.apiKeySource)
+            line(io.err, apiKeyShadowNote(io.apiKeySource));
+        const shadow = shadowingBaseUrl(io.env ?? process.env, origin);
+        if (shadow) {
+            line(io.err, `Note: ${shadow.name}=${shadow.value} is set in your shell and overrides that default — ` +
+                `commands without --base-url will target ${shadow.value}, where you are not signed in. ` +
+                `Unset it, or pass --base-url ${origin} (an MCP config can pin DATUM_BASE_URL in its env).`);
+        }
+        return 0;
+    }
+    catch (err) {
+        if (err instanceof UsageError) {
+            line(io.err, `datum: ${err.message}`);
+            return 2;
+        }
+        if (err instanceof LoginFlowError) {
+            line(io.err, `datum: ${err.message}`);
+            return 1;
+        }
+        throw err;
+    }
+}
+export async function runLogout(baseUrl, io) {
+    const origin = originOf(baseUrl);
+    const had = io.store.delete(origin);
+    line(io.err, had ? `Signed out of ${origin} (local credentials removed; the Microsoft session itself is untouched).` : `Not signed in to ${origin} — nothing to remove.`);
+    return 0;
+}
+/** Who the SERVER says we are (GET /api/me with the bearer) — the honest
+ * answer; the token's own claims are only the fallback when the server is
+ * unreachable. */
+/** `whoami` answered by the API key (no sign-in on this machine): what
+ * `/public/api/me` says of the key, or the same "invalid API key" every
+ * other command reports for a key the server refuses. */
+async function whoamiByKey(target, io) {
+    const insecure = insecureOriginReason(target);
+    if (insecure)
+        throw new UsageError(insecure);
+    const doFetch = io.fetchImpl ?? fetch;
+    const res = await doFetch(`${target}/public/api/me`, {
+        headers: { authorization: `Bearer ${io.apiKey}`, accept: "application/json" },
+        redirect: "manual",
+    });
+    const body = (await res.json().catch(() => ({})));
+    if (!res.ok) {
+        const detail = typeof body.error === "string" ? body.error : `HTTP ${res.status}`;
+        line(io.err, `datum: ${target} answered HTTP ${res.status} — ${detail} (the key from ${io.apiKeySource ?? "the environment"}). ` +
+            `Fix or unset it, or sign in as yourself: \`datum login --base-url ${originOf(target)}\`.`);
+        return 1;
+    }
+    line(io.out, JSON.stringify({
+        baseUrl: target,
+        identity: body.identity ?? null,
+        role: body.role ?? null,
+        roleSource: body.roleSource ?? null,
+        authVia: body.authVia ?? "api-key",
+        // A personal agent's person token (#2719): the person, through their agent.
+        ...(body.via ? { via: body.via } : {}),
+        // …and whether it acts with the person's full reach (#3028).
+        ...(typeof body.fullReach === "boolean" ? { fullReach: body.fullReach } : {}),
+        nextCallUses: `api-key (${io.apiKeySource ?? "?"}) on /public/api`,
+        signedIn: false,
+    }, null, 2));
+    return 0;
+}
+export async function runWhoami(baseUrl, space, io) {
+    const origin = originOf(baseUrl);
+    const doFetch = io.fetchImpl ?? fetch;
+    const target = space ? spaceBaseUrl(origin, space) : origin;
+    let token;
+    try {
+        token = await ensureAccessToken(origin, io.store, io);
+    }
+    catch (err) {
+        // No sign-in, but a key in the flags/environment: the key is what the
+        // next command uses — check IT, like every API command does, instead of
+        // "not signed in (or set DATUM_API_KEY)" to a person whose key is set.
+        if (err instanceof NotLoggedInError && io.apiKey)
+            return whoamiByKey(target, io);
+        if (err instanceof NotLoggedInError || err instanceof LoginFlowError) {
+            line(io.err, `datum: ${err.message}`);
+            return 1;
+        }
+        throw err;
+    }
+    const res = await doFetch(`${target}/api/me`, {
+        headers: { authorization: `Bearer ${token}`, accept: "application/json" },
+        redirect: "manual",
+    });
+    const body = (await res.json().catch(() => ({})));
+    if (!res.ok) {
+        const payload = decodeJwtPayload(token);
+        line(io.err, `datum: ${target} answered HTTP ${res.status}${typeof body.error === "string" ? ` — ${body.error}` : ""}`);
+        if (body.code === "feature_disabled") {
+            line(io.err, "datum: developer access is off for this space — a space admin enables it in Settings → Features");
+        }
+        line(io.err, `datum: the token says you are ${String(payload.preferred_username ?? payload.upn ?? "?")}`);
+        return 1;
+    }
+    // The honest answer to "who am I" includes which credential the NEXT API
+    // command uses: with a key in the flags/environment it is the key (its own
+    // actor, the public surface), whatever this sign-in says.
+    const nextCallUses = io.apiKeySource
+        ? `api-key (${io.apiKeySource}) on /public/api — NOT this sign-in`
+        : "this sign-in (bearer) on /api";
+    if (io.apiKeySource)
+        line(io.err, apiKeyShadowNote(io.apiKeySource));
+    line(io.out, JSON.stringify({
+        baseUrl: target,
+        identity: body.identity ?? null,
+        role: body.role ?? null,
+        roleSource: body.roleSource ?? null,
+        orgRole: body.orgRole ?? null,
+        // Human-readable: the space slugs (older servers answer ids only).
+        spaces: Array.isArray(body.spaces)
+            ? body.spaces.map((s) => s.name && s.name !== s.slug ? `${s.slug} (${s.name})` : (s.slug ?? "?"))
+            : (body.spaceIds ?? []),
+        authVia: body.authVia ?? null,
+        nextCallUses,
+        credentials: io.store.path,
+    }, null, 2));
+    return 0;
+}
+//# sourceMappingURL=authCommands.js.map

package/cli/bundleSignature.js

@@ -0,0 +1,111 @@
+import { createPublicKey, verify } from "node:crypto";
+/**
+ * The signature of the CLI bundle a self-update installs (#2612).
+ *
+ * The integrity the CLI checks comes from the SAME server as the bundle, so
+ * on its own it proves nothing against a hostile server: `datum login
+ * --base-url https://<their-host>` and that host serves whatever it likes.
+ * The signature ties the bundle to Datum's CI instead of to the host:
+ *
+ *   ROOT key (AWS KMS, alias/datum-cli-bundle-signing; public half pinned
+ *   below) ──signs──▶ BUILD key statement { version, build key }
+ *   BUILD key (one-shot, generated per image build) ──signs──▶ bundle
+ *   statement { package name, version, integrity }
+ *
+ * Two steps because the bundle is built INSIDE `docker build`, which never
+ * sees AWS credentials: the image builder's custom-script (on the runner,
+ * with the push role's credentials) mints a build key and has KMS sign it
+ * (scripts/ci/cli-bundle-build-key.sh); the build stage signs the bundle
+ * with it (scripts/sign-cli-bundle.mjs). The build key's statement names
+ * the version, so a leaked build key can sign nothing but bundles of that
+ * one version.
+ *
+ * Statements are fixed text, never JSON — the shell script, the build
+ * stage and this module must produce identical bytes (signatureFormat.test).
+ */
+/** ECDSA P-256 over SHA-256, DER-encoded — what KMS `ECDSA_SHA_256` returns. */
+export const BUNDLE_SIGNATURE_ALGORITHM = "ECDSA_SHA_256";
+/**
+ * Root public keys the CLI trusts: KMS key id → SubjectPublicKeyInfo DER,
+ * base64 (`aws kms get-public-key --query PublicKey`). Rotation ADDS a key
+ * and removes the old one a release later — a CLI only trusts what it ships.
+ */
+export const CLI_BUNDLE_ROOT_KEYS = {
+    // The release root key (AWS KMS alias/datum-cli-bundle-signing, ECC_NIST_P256).
+    "6863765b-af9c-451c-8dc9-babc5807dbc8": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEY+IdP1ekSApHIhR1fXjhliORWmHJgCrnzRUQC0i+8tFmaUbCkh77JyulTvGTZJeTClBueu6raqzXzllSR+oysg==",
+};
+/**
+ * Whether a CLI refuses an unsigned bundle. On since the CLI went to the
+ * public npm registry (#2613): anybody can now be talked into `datum login
+ * --base-url https://<their-host>`, and only the signature keeps that host
+ * from handing over code. A bundle signed by a root key this CLI does not
+ * pin counts as unsigned. The one exception is a loopback dev server.
+ */
+export const REQUIRE_SIGNED_BUNDLES = true;
+/** `1` makes this machine refuse unsigned bundles before the default does. */
+export const ENV_REQUIRE_SIGNED_UPDATE = "DATUM_REQUIRE_SIGNED_UPDATE";
+export function buildKeyStatement(version, key) {
+    return `datum-cli-build-key/v1\nversion=${version}\nkey=${key}\n`;
+}
+export function bundleStatement(name, version, integrity) {
+    return `datum-cli-bundle/v1\nname=${name}\nversion=${version}\nintegrity=${integrity}\n`;
+}
+export function isBundleSignature(v) {
+    if (!v || typeof v !== "object")
+        return false;
+    const o = v;
+    const k = o.buildKey;
+    return (typeof o.name === "string" &&
+        typeof o.signature === "string" &&
+        !!k &&
+        typeof k === "object" &&
+        typeof k.key === "string" &&
+        typeof k.rootKeyId === "string" &&
+        typeof k.signature === "string");
+}
+export class BundleSignatureError extends Error {
+}
+function verifies(statement, spkiBase64, signatureBase64) {
+    try {
+        const key = createPublicKey({ key: Buffer.from(spkiBase64, "base64"), format: "der", type: "spki" });
+        return verify("sha256", Buffer.from(statement, "utf8"), key, Buffer.from(signatureBase64, "base64"));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Judge the signature a server announced for a bundle. `{ signed: false }`
+ * when there is nothing this CLI can check (no signature, a root key it does
+ * not know — a rotation it predates); THROWS when a signature is there and
+ * does not hold, or holds for another package or version — that is never a
+ * bundle to install, whatever the policy.
+ */
+export function checkBundleSignature(pkg, opts) {
+    const rootKeys = opts.rootKeys ?? CLI_BUNDLE_ROOT_KEYS;
+    if (pkg.signature === undefined || pkg.signature === null)
+        return { signed: false, reason: "the server announced no signature" };
+    if (!isBundleSignature(pkg.signature))
+        throw new BundleSignatureError("the server announced a malformed bundle signature");
+    const sig = pkg.signature;
+    const root = rootKeys[sig.buildKey.rootKeyId];
+    if (!root)
+        return { signed: false, reason: `signed by a root key this CLI does not know (${sig.buildKey.rootKeyId})` };
+    if (!verifies(buildKeyStatement(pkg.version, sig.buildKey.key), root, sig.buildKey.signature)) {
+        throw new BundleSignatureError(`the bundle's build key is not signed for ${pkg.version} by the Datum root key`);
+    }
+    if (!opts.packageNames.includes(sig.name)) {
+        throw new BundleSignatureError(`the bundle is signed as ${sig.name}, not as the datum CLI`);
+    }
+    if (!verifies(bundleStatement(sig.name, pkg.version, pkg.integrity), sig.buildKey.key, sig.signature)) {
+        throw new BundleSignatureError("the bundle signature does not match its version and integrity");
+    }
+    return { signed: true, rootKeyId: sig.buildKey.rootKeyId, name: sig.name };
+}
+/** Is an unsigned bundle refused here? Never for a loopback dev server. */
+export function signatureRequired(env, loopback, base = REQUIRE_SIGNED_BUNDLES) {
+    if (loopback)
+        return false;
+    return base || env[ENV_REQUIRE_SIGNED_UPDATE]?.trim() === "1";
+}
+//# sourceMappingURL=bundleSignature.js.map